At 06:42 on a Monday, a UK professional services firm found its shared drives inaccessible. Staff were met with ransom notes, file extensions had changed overnight, and the managing partner wanted one answer before the business opened: had client data been taken, or merely encrypted?
This ransomware investigation case study is anonymised, but reflects the evidential and technical issues that commonly arise when an organisation must contain an attack while preserving material for insurers, regulators, solicitors and potential proceedings. The decisive work was not simply identifying malware. It was establishing a reliable account of what happened, when it happened, what evidence supported each finding, and what could not be proved.
The incident: encryption was only one part of the case
The firm operated from one main office with remote access for staff and a small internal IT team supported by a managed service provider. Overnight, a ransomware group had encrypted document shares, departmental folders and several virtual servers. A ransom note alleged that confidential client files had been copied before encryption and threatened publication if payment was not made.
The initial instinct was understandable: restore systems as quickly as possible. However, rebuilding or wiping every affected device without recording its condition risked destroying evidence of the initial compromise, the attacker’s actions and the scope of potential data exfiltration. It could also make later assertions about notification, loss and attribution difficult to defend.
The organisation therefore separated urgent business recovery from forensic preservation. That distinction mattered. A functioning network is essential, but recovery activity must not overwrite the very records needed to determine whether a reportable data breach occurred or whether a third party’s conduct contributed to the loss.
Preserving evidence before it changed
The first task was to contain the incident without conducting uncontrolled “clean-up”. Remote access was restricted, compromised accounts were disabled, and affected systems were isolated where operationally possible. The response team recorded who took each action, at what time and for what reason.
Forensically sound copies were then obtained from priority systems. These included the domain controller, the remote access server, a file server, a virtualisation host and selected staff laptops. Available firewall, endpoint protection, VPN, cloud audit and backup logs were secured before normal retention settings removed them. A copy of the ransom note, associated files and relevant attacker communications was retained as evidential material.
Chain of custody was maintained from the outset. Each device and data export was identified, recorded, securely stored and, where appropriate, cryptographically hashed. This does not turn every item of data into conclusive proof. It does allow an expert to demonstrate that the material examined was preserved in a controlled manner and had not been altered after acquisition.
This is particularly significant where a claim may follow. A party alleging that a particular employee, supplier or attacker caused loss may face close scrutiny over the reliability of its digital evidence. Equally, a defence team may need to challenge assumptions based on incomplete logs or systems that were rebuilt before examination.
Why live evidence can be decisive
Some information exists only while a device is running. Active network connections, logged-on users, running processes, encryption keys and volatile memory may disappear when a machine is powered down. In this case, a controlled capture of live data from one affected server assisted in identifying a suspicious remote administration process and its connection history.
Live capture is not always appropriate. It depends on the risk of further damage, the available expertise and the evidential objectives. An untrained attempt to collect volatile data can alter the system and create confusion about what was originally present. The method must be proportionate, documented and undertaken by personnel able to explain it.
Reconstructing the route into the network
The forensic examination identified signs of unauthorised access several days before the encryption event. VPN logs showed successful connections from an unfamiliar overseas IP address using a valid employee account outside normal working patterns. The account had multi-factor authentication disabled during a previous support change, a fact confirmed through configuration records and service desk correspondence.
Further review showed that the compromised credentials had been used to access a remote desktop service and to enumerate shared folders. Security logs indicated privilege escalation within the domain, followed by the deployment of tools capable of disabling endpoint protections and distributing the ransomware payload.
The timeline was built from multiple independent sources rather than any single log. This was necessary because timestamps may use different time zones, logs may be incomplete, and attackers frequently clear or tamper with records. File system artefacts, Windows event logs, firewall records, endpoint telemetry and cloud sign-in data were normalised into a single chronology.
The investigation could support the conclusion that the attacker gained access using a genuine account and later moved through the network. It could not establish, on the available evidence, exactly how the credentials were obtained. A phishing email was a possibility, but no retained email artefact proved it. Stating that limitation plainly was as important as setting out the positive findings.
Ransomware investigation case study: was data exfiltrated?
The question of exfiltration often carries the greatest legal and commercial consequence. Encryption disrupts operations. Unauthorised copying of personal, confidential or legally privileged information may create a separate and more enduring exposure.
The attacker’s ransom note was not treated as proof. Extortion groups have a clear incentive to overstate what they possess. Instead, the examination considered network traffic, proxy records, cloud logs, staging directories, command history and unusual archive creation on compromised systems.
Investigators found evidence that several compressed archive files had been created on a server shortly before encryption. Network telemetry also showed substantial encrypted outbound traffic to an external hosting service during the same period. The volume was consistent with the transfer of a significant quantity of data, although the encryption of the traffic prevented direct examination of its contents.
That distinction shaped the expert opinion. The available evidence supported a finding that data was likely staged and transferred. It did not permit a definitive statement that every file within the affected shares had been exfiltrated, nor could it prove that the attacker retained or later published the data. The report identified the relevant folders, estimated the potential data categories involved and explained the evidential limits.
For legal advisers and data protection teams, this is the point at which precision matters most. Overstating certainty can undermine credibility. Understating the risk can lead to inadequate notifications, poorly framed client communications or decisions made without a proper factual basis.
The recovery decision and its evidential consequences
The organisation had offline backups that pre-dated the attack by 48 hours. That allowed controlled restoration after the affected environment had been rebuilt and credentials reset. The business chose not to pay the ransom, based on the availability of recovery options and the lack of any reliable assurance that payment would prevent disclosure.
Payment decisions are complex and case-specific. They may involve business continuity, contractual obligations, sanctions considerations, insurer requirements and the safety of individuals whose data may be involved. A forensic investigator’s role is not to make that commercial decision. It is to provide an impartial account of the evidence, preserve attacker communications and help establish what recovery routes are technically viable.
In this matter, the preservation of backup logs and restoration records later proved valuable. They showed which systems were restored, which data sets were potentially unavailable, and how the business calculated the interruption period. That material supported discussions with insurers and assisted solicitors in assessing potential losses.
What made the findings defensible
The technical findings were only useful because they could be explained and tested. The final report set out the instructions received, the exhibits examined, acquisition methods, hash values, tools used, relevant time settings and the reasoning behind each conclusion. It separated observed facts from inference and highlighted gaps in the evidence.
A defensible ransomware investigation should also avoid premature attribution. An IP address, a ransom note style or a malware family may suggest a group’s involvement, but attribution to a particular individual or organisation requires a much higher evidential threshold. In many civil and criminal contexts, the honest conclusion is that the activity is consistent with a known method, not that a named actor has been proved responsible.
The same discipline applies to internal responsibility. A missing security control may expose a weakness, but it does not automatically establish negligence, contractual breach or causation. Those are legal questions informed by evidence, scope of duty and the surrounding facts.
The practical lesson for organisations and legal teams
A ransomware incident can become a dispute long after systems are restored. There may be an insurer’s coverage enquiry, a claim against a supplier, regulatory engagement, employment issues, client complaints or proceedings involving alleged losses. By then, overwritten logs and casually handled devices cannot be recreated.
The most useful early decision is to treat the incident as both a security emergency and a potential evidence matter. Preserve priority systems, restrict access to original data, record every material action and obtain independent forensic advice before irreversible remediation where circumstances permit. Computer Forensics Lab can assist where the facts need to be recovered, examined and presented in a form suitable for legal scrutiny.
When the pressure to restore services is at its highest, disciplined evidence handling protects more than the investigation. It protects the organisation’s ability to establish the truth when that truth is later challenged.